LA’s use of Citizen for contact tracing has some privacy advocates worried
Los Angeles Mayor Eric Garcetti announced on Wednesday the city will debut a new contact-tracing app developed by Citizen, a developer accused by some privacy advocates of “breeding paranoia.”
Garcetti, flanked by Citizen CEO Andrew Frame and several regional health officials, said at a press conference Wednesday that the city will integrate a mobile app called “SafePass” into its existing COVID-19 response, which has tested two million Angelenos so far this year. The app allows users to self-report COVID-19 symptoms and receive notifications from the county’s health department, while some users can receive free at-home testing kits.
Similar to other contact-tracing apps, like those developed using an API jointly developed by Google and Apple, LA’s app will use Bluetooth connections to track potential coronavirus exposures. City officials said that all the contact-tracing data collected by SafePass will be immediately anonymized and deleted after 30 days, but Angel Diaz, a lawyer at the Brennan Center for Justice, said Citizen is known for flouting privacy concerns.
“This app collects A LOT of personal information, including location data, copies of gov-ID, COVID-19 diagnosis information, and undefined ‘health information.’ They only commit to deleting Bluetooth data & gov-id in 30 days. Nothing else is subject to any regular deletion policy,” Diaz tweeted Thursday morning.
The criticism of Citizen’s privacy policies stems largely from an existing app, to promote public safety, that’s been download by at least four million users nationwide, with almost a quarter of them in the Los Angeles region. The app is comparable to hyperlocal news apps like NextDoor that encourage users to post what’s happening on their block. When the app is opened, users see an interactive map that’s dotted with different crises or emergencies in their city, and like a social media platform, they can comment or stream video of an incident if it’s happening in front of them in real time. The company even hires residents of cities that it’s moving into to film incidents to create content for the app, ideally stirring up interest for other residents, Wired reported earlier this year.
Diaz, who said that he helped New York analyze and eventually turn down Citizen’s contact-tracing technology earlier this year, said that kind of mission reflects poorly on a company being asked to keep people safe from a virus they can’t see.
“The privacy policy contemplates that users can opt-into sharing diagnosis information with government agencies, but doesn’t specify who those agencies are. Agreeing to share data with public health officials is not the same thing as agreeing to share information with LAPD or ICE,” Diaz tweeted.
Los Angeles officials did not acknowledge any privacy concerns in announcing the app on Wednesday, and encouraged users to download the SafePass app, as well as share the announcement with their friends and family.
“Contact tracing relies on residents sharing with us key information to identify close contacts, and today we are adding additional capacity for our program through SafePass,” said Barbara Ferrer. the city’s public health director. “This new tool allows everyone to share responsibility for protecting each other, and I want to thank Citizen for their innovation and commitment to helping us slow the spread of COVID-19.”
While at least 16 foreign countries and U.S. states, including Alabama, Nevada, Pennsylvania and Virginia, have launched contact-tracing apps that rely on APIs developed by Google and Apple, those applications don’t track users’ locations via GPS. But the Citizen SafePass app uses GPS and stores users’ locations for 30 days. Diaz said the app’s privacy protections don’t go anywhere near far enough.
“It’s hard to imagine a company worse-suited to convince Angelenos that public health surveillance isn’t a trojan horse for police surveillance,” Diaz tweeted.
